Privacy Policy
1. Who we are
Zabibu ("Zabibu", "we", "us") is an app for everyone, locals, travelers and digital nomads, to find activities and meet people nearby. It is operated by Razor Informatics, based in Kenya, who is responsible for your personal data under this policy. You can reach us at info@razorinformatics.co.ke.
2. What we collect
Information you give us
- Account: your sign-in details from Google or Apple (such as your email address and account ID), handled by our sign-in provider.
- Profile: first name, date of birth (we show your age, never the date), gender, home country, the city you're based in and how long you're staying, bio, interests, travel style, languages, Instagram username (optional) and photos.
- Trips and activities: places you plan to visit and their dates, activities you create or join, and your join requests.
- Messages: what you send in activity chats, city chats and direct messages, including photos.
- Safety: people you block, reports you send, and whether you agreed to our meetup safety tips.
- Settings: your privacy, notification and display preferences.
Information collected when you use the app
- Approximate location: if you allow location access, we use your device's location while the app is open to show what's near you. We store it rounded to about 1 km and never store your exact position. We don't track your location in the background.
- Device and notifications: a push notification token so we can send you the notifications you turned on.
- Usage and diagnostics: which screens are used and how the app performs, and crash reports, so we can fix problems and improve the app.
- Purchases: whether you have a Plus subscription and when it renews. Payments are handled by Apple or Google; we never see your card details.
Ambassador programme (Nairobi)
If you apply to be a Zabibu ambassador through zabibu.app/ambassadors-ke, we also collect what you put in the application form: your name, M-Pesa number (used to pay you), WhatsApp number (used to invite you to the ambassadors' WhatsApp group), Instagram or TikTok username, follower count, Nairobi area and your Zabibu User ID, plus the screenshots you send us to show you completed the steps. We use these only to check your application, match you to your Zabibu profile, verify your steps, pay you and prevent duplicate or fraudulent applications. The form is hosted by Google (Forms and Sheets), payments are sent through M-Pesa (Safaricom) and the group runs on WhatsApp (Meta), where other members of the group can see your name, number and the screenshots you post there. We keep application records for up to 12 months after the programme ends, and payment records for as long as accounting and tax law require. If you ask us to delete your application data (see your rights), we delete it unless we must keep a payment record.
iPhone waitlist
If you join the iPhone waitlist at zabibu.app/ios-waitlist, we collect the first name and email address you enter. We use them only to send you one message when Zabibu is available on the App Store, and we delete the list after we send it (or on request, see your rights). The form is hosted by Google (Forms and Sheets). We don't sell them or use them for marketing.
Photo checks
When you add your main profile photo, the app checks on your phone that it shows a face. That check doesn't send your photo anywhere. Photos you upload (profile photos and chat photos) are then automatically screened for nudity and violence before other people can see them.
Message checks
Zabibu is for making friends and doing things together, not dating. Text messages are automatically checked against a list of romantic and sexual phrases. A message that looks like a romantic or sexual advance may be flagged: the person who received it (in a direct message) is offered to block or report the sender, and our team may review flagged messages when deciding on warnings or bans. We may use an AI service to double-check messages the phrase list picks up; only those messages are sent, without your name or profile.
3. How we use it
- To run Zabibu: show activities and people near you, run chats and trips, and send the notifications you choose.
- To keep the community safe: screen photos, check messages for romantic or sexual advances, act on reports, enforce our Community guidelines, and prevent spam, fraud and misuse.
- To provide Plus: check your subscription and unlock its features.
- To support you and tell you about important changes to the app or these policies.
- To understand how the app is used and fix bugs.
We don't sell your personal data, we don't use it for advertising, and we don't make automated decisions that have legal effects on you.
4. What other people can see
Other Zabibu users can see your public profile: first name, photos, bio, interests, travel style, languages, home country, the city you're based in, and your trips. Depending on your settings they may also see your age, gender, approximate distance from them and your Instagram username. They never see your exact location, date of birth or email address. Messages are visible to the people in that chat. You control the optional parts under Settings → Visibility, and you can hide yourself from nearby lists with Snooze.
5. Who we share it with
We share data only with service providers that help us run Zabibu, under agreements that limit how they can use it:
| Provider | What for |
|---|---|
| Clerk | Sign-in and account security |
| Convex | Database, file storage and server functions (where your profile, messages and photos are stored) |
| Google (Maps, Places, Cloud Vision, Firebase Cloud Messaging) | Maps and place search, photo screening, and Android notifications |
| Anthropic (only if AI message checks are turned on) | Double-checking messages our phrase list flags as possible romantic or sexual advances |
| Expo | Delivering push notifications |
| Apple and Google app stores | App distribution and payments |
| RevenueCat | Managing Plus subscriptions |
| PostHog | Product analytics |
| Google (Analytics for Firebase, Google Ads) | Measuring which ads lead to installs and sign-ups, and product analytics, on Android (uses your device's advertising ID) |
| Sentry | Crash and error reports |
| Google (Forms, Sheets) | Ambassador programme applications (only if you apply) |
| Safaricom (M-Pesa) | Paying ambassadors (only if you are paid) |
| WhatsApp (Meta) | Ambassadors' group chat (only if you are approved and join) |
We may also share information when the law requires it, to protect someone's safety (for example, responding to a credible threat reported to us), or as part of a merger or sale of the service, in which case this policy would continue to apply to your data.
6. Legal bases (EEA / UK)
- Contract: to provide the app you signed up for.
- Legitimate interests: to keep the community safe, prevent misuse, and improve the app.
- Consent: for location access and push notifications, which you can withdraw at any time in your phone's settings.
- Legal obligation: where we must keep or share information by law.
7. How long we keep it
- We keep your data while your account is active.
- When you delete your account (Settings → Delete account), your profile is hidden from everyone immediately and permanently deleted after 30 days. Logging back in during those 30 days restores it.
- After deletion, messages you sent in group chats stay visible to the other members but show "Deleted user" instead of your name; photos you sent are deleted.
- Reports about serious safety issues may be kept for longer where needed to protect others or meet legal obligations.
- Analytics and crash data are kept for a limited time by the providers above.
See how to delete your account.
8. Your choices and rights
- Edit your profile and visibility settings in the app at any time.
- Turn notifications and location access on or off in the app or your phone's settings.
- Delete your account in the app.
- Depending on where you live (for example under the GDPR, the UK GDPR or California law), you may have the right to access, correct, export or delete your data, and to object to or restrict how we use it. Email info@razorinformatics.co.ke and we'll respond within 30 days. You can also complain to your local data protection authority; in Kenya that's the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, 2019.
- California residents: we don't sell or "share" personal information for cross-context advertising.
9. International transfers
Our service providers may process data in countries other than yours, including the United States. Where required, these transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses.
10. Security
Data is encrypted in transit, access is limited to what's needed to run the service, and photos are only shown to others once screened. No system is perfectly secure, so please use a strong sign-in method and report anything suspicious.
11. Age limit
Zabibu is only for people aged 18 or over. We don't knowingly collect data from anyone younger; if we learn we have, we delete the account.
12. Changes and contact
If we make important changes to this policy, we'll let you know in the app before they take effect. Questions or requests: info@razorinformatics.co.ke.